1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Help needed with excessive disk activity on Windows Vista Home Premium Edition

Discussion in 'Windows Vista' started by tomdkat, Aug 23, 2010.

Thread Status:
Not open for further replies.
Advertisement
  1. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    So, my neighbor has an Acer system with a Pentium D processor running @ 3GHz and 1GB of RAM. It's got Windows Home Premium Edition installed and the hard drive light stays on almost constantly.

    When I first looked at the system, it had no anti-virus software installed and Windows Defender was out of date. It also had NO service packs installed.

    So, I installed Malwarebytes and ran a scan and it found MyWebSearch, FunWebProducts, and some registry traces of a Vundo trojan. After getting that cleaned up, I installed service packs 1 and 2 and Microsoft Security Essentials. A MSE scan found some infected audio files downloaded via Limewire but nothing running RAM and nothing in the registry.

    The constant disk activity persisted after the above system changes. So, i did some research and found some possible culprits:
    • SuperFetch
    • ReadyBoost
    • Windows Defender
    • Windows Search (Indexing function)

    Windows Defender is no longer installed on the system (I think the MSE installer uninstalled it). I've disabled SuperFetch and ReadyBoost and disk activity seemed to reduce some but there still seems to be far too much activity. The hard drive light will stay mostly light (blinking a lot) if not on solid pretty much the entire time the system is booted. As a result, the system is running slower than it probably should.

    Peak RAM usage I've monitored using Task Manager is right around 800MB, so there doesn't appear to be any swapping or thrashing due to RAM exhaustion.

    I've run a chkdsk on the C: drive and it came up clean with the exception of a MFT issue that was fixed with a "chkdsk /f" that was run at the subsequent system boot.

    The system is fully patched with Windows Updates except for some MS Office updates which refuse to install, for some reason. I haven't investigated that yet.

    Oh yeah, when I first started looking at the machine, I ran a download speed test and got a 6Mbps download speed which is too slow, considering they have the Comcast "Blast" Internet service package which gets them closer to 20Mbps download speeds. After making the above changes, speed tests now indicate download speeds between 19Mbps and 21Mbps. So, the above changes have helped some even though I can't figure out what is spinning the disk so much.

    I've enabled the "I/O Read, I/O Write, and I/O Other" columns in Task Manager and nothing really jumps out, except for MSE having unexpectedly high I/O Read and I/O Other counts (talking 10s of thousands) or an occasional "lsass" or "csrss.exe" taking the top position.

    Any other ideas on things to check? I have NOT disabled Window Search (indexing) yet and I plan on trying that next.

    Thanks!

    Peace...
     
  2. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    I'm still looking into this issue and now I'm looking at the "Resource Monitor", which I started from within Task Manager.

    In the "Disk" section, the following processes are reported as reading from the disk the most;

    svchost.exe (netsvcs) C:\Windows\Softwaredistribution\Datastore\Datastore.edb
    svchost.exe (netsvcs) c:\pagefile.sys
    MsMpEng.exe c:\pagefile.sys

    Those three seem to be generating the most disk activity. I know MsMpEng.exe is part of Microsoft Security Essentials and it's doing an update right now. I have no idea why the "svchost.exe" entry for the datastore.edb file is hitting the disk so much. I believe "datastore.edb" is part of Windows Update.

    The system has 1GB of RAM installed and right now less than 800MB of RAM is being used, so I don't think the system should be swapping at all.

    I'm thinking that maybe increasing the amount of installed RAM from 1GB to 2GB might help alleviate the disk activity. I haven't (yet) turn off the indexing service but I'm not seeing anything in the resource monitor that indicates that is what is beating on the disk so much.

    Your thoughts? Any other ideas?

    Thanks!

    Peace...
     
  3. pubtech

    pubtech

    Joined:
    Aug 24, 2010
    Messages:
    368
    hi, i tend to think your suspicion is right. turn off the indexing service.

    might also try >>

    Disable Hibernation:

    1. Click Start, All Programs, and then right click on “Command Prompt”.

    2. From the context menu click on “Run as administrator”.

    3. If User Account Control prompts you to allow the action, click on Continue.

    4. In the command prompt window, type “powercfg –h off” (without the quotes).

    4. Close the Command Prompt window.

    Delete the Hibernation File:

    1. Click Start, All Programs, Accessories, System Tools, and then click “Disk Cleanup”.

    2. If prompted to choose a drive, select the drive in which Windows Vista is installed on to and press OK.

    3. Disk Cleanup will scan the hard drive and present you with a list of options.

    4. Check “Hibernation File Cleaner”, and then click OK.
     
  4. helpful

    helpful

    Joined:
    Sep 17, 2009
    Messages:
    697
    Peak RAM usage, where are you getting that number from? Try instead

    1) When experiencing the Disk Activity, Open up resource monitor
    2) Navigate to the Memory Tab
    3) Under the physical memory table, please post the "In Use" and "standby" megabytes size
    4) Under the process table sort by commit charge, please post the results of the top three processes

    The minimum specs for premium editions of Windows Vista is 1024 MB so with additional application memory requirements you could be experiencing thrashing due to RAM exhaustion :). The additional information requested will give us a better idea of whether this is related to memory exhaustion and what process are consuming the most memory.
     
  5. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    Thanks! I'll disable hibernation if it's currently enabled. This is a desktop system and I believe they shut down the system when they are done using it each day.

    From Task Manager. It didn't report the "Peak" number but as I watched the "Performance" tab numbers while the system was booting and while running some apps, like a browser, the amount of memory reported as being used in the "Memory" bar chart never got about 800MB.

    Ok, I'll see if I can get that data today. As I described above, the disk is active pretty much from the time the system starts booting until we shut it down. So, I'll gather the numbers after a fresh boot and without running any apps manually.

    When looking at the Task Manager data, the amount of free memory was reported as 0 and the amount cached memory was in the 500MB range. I was under the impression Windows would free up cached memory as running apps needed memory, which is why I initially thought the 1GB of RAM installed would or should be sufficient.

    Thanks to you both!

    Peace...
     
  6. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    Ok, sorry for the delay but "life got in the way". :)

    Apparently, Windows 7 has the tab you mention. Windows Vista doesn't. At least not the Home Premium edition I'm working with. Attached are a couple of screenshots of the Resource Monitor's display of the Memory usage.

    Peace...
     

    Attached Files:

  7. helpful

    helpful

    Joined:
    Sep 17, 2009
    Messages:
    697
    Are you using other security programs? If so remove all other real-time protection security software from the PC.

    MsMpEng.exe is related to Microsoft security essentials.

    If you have no other security software try updating Security essentials

    http://www.microsoft.com/security_essentials/
     
  8. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    Yep, Spybot S&D is installed but TeaTimer (the realtime protection) is disabled. Malwarebytes (free edition) is installed and it doesn't enable any realtime protection.

    Norton Internet Security was installed on the system but it had expired so I removed it by performing a standard uninstall first and then running the Norton Removal Tool (downloaded from the Symantec support site) to make sure no traces were left.

    Currently, Microsoft Security Essentials reports itself as being the latest version (I don't know the specific version number) and having the latest definitions. The disk activity was noticed before installing MSE but I didn't make note of which particular process was "spinning the disk" since I was in malware removal mode, at that time.

    We can upgrade the system from 1GB to 2GB of RAM for about $45, so I think we'll give that a try and see what happens. If the disk activity remains, at least Vista will have more "breathing room". :) The maximum amount of RAM this system supports is 2GB.

    Also, I have not (yet) disabled the indexing service (not sure why) but I'll do that while waiting for the RAM to arrive.

    Thanks!

    Peace...
     
  9. dumguy

    dumguy

    Joined:
    Oct 14, 2010
    Messages:
    2
    I had the same/similar problem with my PC, and it was driving me nuts. One particular application seemed to trigger this constant pulse of 15-30MB writes to my hard drive every second or two if I ignored it for more than about 30 seconds. My system would almost freeze up until I killed that program. SVCHOST was the process generating the writes, but the program that was the catalyst didn't seem to be related to SVCHOST in any way.

    When I first got this problem, I contacted the software vendor and my tech people. Initially I thought it was a "soft" spot on my hard drive and the system was having trouble writing to those sectors. Replacing and ghosting the drive initially seemed to work, but the problem came back within a few days. I didn't want to have to do a complete operating system / disk rebuild because I like all of my current settings and applications. Finally I asked my IT people for a new build or complete new drive with a fresh OS install.

    When I installed the most recent set of patches to Windows and the various other Microsoft applications, I got this pulsing right after booting. I tried all of the suggestions I could find on the Internet, and my tech people at the office were of no use. I finally dug deep enough in the processes and threads on my PC to find that the thread generating the calls was qmgr.dll. More research said that this thread was driven by the Background Intelligent Transfer Service (BITS) that "helps" with downloads and updates from Microsoft. BITS had to die.

    I went into the "Control Panel" from the Start Menu, then "Services" and right clicked on "Background Intelligent Transfer Service". Clicking on the drop-down for "Startup type" I selected "Disabled" and stopped the service as well.

    Instantly the hard drive thrashing stopped. Upon rebooting, no thrashing and constant writes. I left the application that seemed to trigger the problem initially open overnight, and flat lines this morning on my disk activity.

    I left all of my anti virus and other services running as they don't seem to be what caused this issue.

    Sorry about some of the excessive explanation, but if a non-technical person stumbles across this thread, I hope it will save them a lot of time. I am running Windows XP Service Pack 3 on a standard system. I'm assuming that a similar process is available in Vista and maybe even Windows 7.

    Good luck.
     
  10. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    Thanks for the info! Does disabling BITS prevent automatic updates from installing?

    Peace...
     
  11. dumguy

    dumguy

    Joined:
    Oct 14, 2010
    Messages:
    2
    I'm not sure if there have been any updates since I disabled it last night. I kept the "Automatic Updates" service running (initially I disabled both), so I would think that you would still get notified about them. If I think about it, I'll check in a few weeks to see what updates Microsoft says I should have from their website vs. what I actually get.

    I have my updates set to notify me that there are updates available, but that I have to actually authorize them before installation. I think that BITS was downloading them in advance (or prefetching them), but I didn't really pay attention.
     
  12. tomdkat

    tomdkat Trusted Advisor Thread Starter

    Joined:
    May 6, 2006
    Messages:
    7,141
    Well, I had a chance to try this on another Windows Vista system last night and stopping the BITS service seemed to do the trick! Thanks again for the info! Now, I'm off to see what the ramifications of disabling it are. :)

    Peace...
     
  13. helpful

    helpful

    Joined:
    Sep 17, 2009
    Messages:
    697
    no automatic updates, ms security defs updates, or any program that depends on the bits service for remote file transfers. There is also a chance that the disk writes were caused by the dependency program/service and not BITS itself.

    For instance when installing automatic updates, your disk activity would increase but if bits is disabled no automatic updates can be downloaded and therefore no updates would be installed (and you would see no disk activity).

    In addition to the instruction below you can also set automatic update to prompt to install and see if that makes the exessive disk activity cease.

    Maybe try this link instead to repair bits

    http://www.microsoft.com/downloads/...60-4045-435b-b165-2c1496cd94a4&displaylang=en

    look here for more info

    http://support.microsoft.com/kb/940520
     
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/945275